Fix spilling bug in linearscan

If we reload a value in an exit trace that was spilled
in the main trace, a comment tells us that we reload it at the
start of the exit trace. In fact the reload was inserted at the
start of the main trace.

Fixed the code to match the comment.

hphp/runtime/vm/jit/linearscan.cpp

@@ -1191,7 +1191,7 @@ void LinearScan::allocRegsOneTrace(BlockList::iterator& blockIt,
         assert(!spill->block()->trace()->isMain());
         spill = spill->clone(m_irFactory);
       }
-      block->trace()->front()->prepend(spill);
+      trace->front()->prepend(spill);
     } else if (inst->isBlockEnd()) {
       block->next()->prepend(spill);
     } else {

hphp/test/slow/compilation/exitspill.php

@@ -0,0 +1,28 @@
+<?php
+
+define('FIZ', 32);
+
+class X {
+  const FOO = 1;
+  const BAR = FIZ;
+  const BAZ = FIZ;
+  const BOO = FIZ;
+  const BIZ = FIZ;
+  const FIZ = FIZ;
+}
+
+function foo($a, $b) {
+  var_dump($a, $b);
+}
+
+function f() { return FIZ; }
+
+function test() {
+  foo(f(), array(X::FOO, X::BAZ,
+                 X::BAR, X::BAZ,
+                 X::BOO, X::BIZ));
+}
+
+test();
+
+

hphp/test/slow/compilation/exitspill.php.expect

@@ -0,0 +1,15 @@
+int(32)
+array(6) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(32)
+  [2]=>
+  int(32)
+  [3]=>
+  int(32)
+  [4]=>
+  int(32)
+  [5]=>
+  int(32)
+}